jumpserver/jperm/views.py

# coding: utf-8

import sys
reload(sys)
sys.setdefaultencoding('utf8')
import datetime


from django.core.mail import send_mail
from django.shortcuts import render_to_response
from django.http import HttpResponseRedirect, HttpResponse
from django.template import RequestContext
from juser.models import User, UserGroup, DEPT
from jasset.models import Asset, BisGroup
from jperm.models import Perm, SudoPerm, CmdGroup, Apply
from django.core.paginator import Paginator, EmptyPage, InvalidPage
from django.db.models import Q
from jumpserver.views import LDAP_ENABLE, ldap_conn, CONF, page_list_return, pages
from jumpserver.api import *


def asset_cmd_groups_get(asset_groups_select='', cmd_groups_select=''):
    asset_groups_select_list = []
    cmd_groups_select_list = []

    for asset_group_id in asset_groups_select:
        asset_groups_select_list.extend(BisGroup.objects.filter(id=asset_group_id))

    for cmd_group_id in cmd_groups_select:
        cmd_groups_select_list.extend(CmdGroup.objects.filter(id=cmd_group_id))

    return asset_groups_select_list, cmd_groups_select_list


@require_admin
def perm_add(request):
    header_title, path1, path2 = u'主机授权添加', u'授权管理', u'授权添加'

    if request.method == 'GET':
        user_groups = UserGroup.objects.filter(id__gt=2)
        asset_groups = BisGroup.objects.all()

    else:
        name = request.POST.get('name', '')
        user_groups_select = request.POST.getlist('user_groups_select')
        asset_groups_select = request.POST.getlist('asset_groups_select')
        comment = request.POST.get('comment', '')

        user_groups, asset_groups = user_asset_cmd_groups_get(user_groups_select, asset_groups_select, '')[0:2]

        perm = Perm(name=name, comment=comment)
        perm.save()

        perm.user_group = user_groups
        perm.asset_group = asset_groups
        msg = '添加成功'
    return render_to_response('jperm/perm_add.html', locals(), context_instance=RequestContext(request))


def dept_add_asset(dept_id, asset_list):
    dept = DEPT.objects.filter(id=dept_id)
    if dept:
        dept = dept[0]
        new_perm_asset = []
        for asset_id in asset_list:
            asset = Asset.objects.filter(id=asset_id)
            new_perm_asset.extend(asset)

        dept.asset_set.clear()
        dept.asset_set = new_perm_asset


@require_super_user
def dept_perm_edit(request):
    header_title, path1, path2 = u'部门授权添加', u'授权管理', u'部门授权添加'
    if request.method == 'GET':
        dept_id = request.GET.get('id', '')
        dept = DEPT.objects.filter(id=dept_id)
        if dept:
            dept = dept[0]
            asset_all = Asset.objects.all()
            asset_select = dept.asset_set.all()
            assets = [asset for asset in asset_all if asset not in asset_select]
    else:
        dept_id = request.POST.get('dept_id')
        asset_select = request.POST.getlist('asset_select')
        dept_add_asset(dept_id, asset_select)
        return HttpResponseRedirect('/jperm/dept_perm_list/')
    return render_to_response('jperm/dept_perm_edit.html', locals(), context_instance=RequestContext(request))


@require_super_user
def perm_list(request):
    header_title, path1, path2 = u'小组授权', u'授权管理', u'授权详情'
    keyword = request.GET.get('search', '')
    if keyword:
        contact_list = UserGroup.objects.filter(Q(name__icontains=keyword) | Q(comment__icontains=keyword))
    else:
        contact_list = UserGroup.objects.all().order_by('name')

    contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(contact_list, request)
    return render_to_response('jperm/perm_list.html', locals(), context_instance=RequestContext(request))


@require_admin
def perm_list_adm(request):
    header_title, path1, path2 = u'小组授权', u'授权管理', u'授权详情'
    keyword = request.GET.get('search', '')
    user, dept = get_session_user_dept(request)
    contact_list = dept.usergroup_set.all().order_by('name')
    if keyword:
        contact_list = contact_list.filter(Q(name__icontains=keyword) | Q(comment__icontains=keyword))

    contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(contact_list, request)
    return render_to_response('jperm/perm_list.html', locals(), context_instance=RequestContext(request))


@require_super_user
def dept_perm_list(request):
    header_title, path1, path2 = '查看部门', '授权管理', '部门授权'
    keyword = request.GET.get('search')
    if keyword:
        contact_list = DEPT.objects.filter(Q(name__icontains=keyword) | Q(comment__icontains=keyword)).order_by('name')
    else:
        contact_list = DEPT.objects.filter(id__gt=1)

    contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(contact_list, request)

    return render_to_response('jperm/dept_perm_list.html', locals(), context_instance=RequestContext(request))


def perm_group_update(user_group_id, asset_groups_id_list):
    user_group = UserGroup.objects.filter(id=user_group_id)
    if user_group:
        user_group = user_group[0]
        old_asset_group = [perm.asset_group for perm in user_group.perm_set.all()]
        new_asset_group = []

        for asset_group_id in asset_groups_id_list:
            new_asset_group.extend(BisGroup.objects.filter(id=asset_group_id))

        del_asset_group = [asset_group for asset_group in old_asset_group if asset_group not in new_asset_group]
        add_asset_group = [asset_group for asset_group in new_asset_group if asset_group not in old_asset_group]

        for asset_group in del_asset_group:
            Perm.objects.filter(user_group=user_group, asset_group=asset_group).delete()

        for asset_group in add_asset_group:
            Perm(user_group=user_group, asset_group=asset_group).save()


@require_super_user
def perm_edit(request):
    if request.method == 'GET':
        header_title, path1, path2 = u'编辑授权', u'授权管理', u'授权编辑'
        user_group_id = request.GET.get('id', '')
        user_group = UserGroup.objects.filter(id=user_group_id)
        if user_group:
            user_group = user_group[0]
            asset_groups_all = BisGroup.objects.all()
            asset_groups_select = [perm.asset_group for perm in user_group.perm_set.all()]
            asset_groups = [asset_group for asset_group in asset_groups_all if asset_group not in asset_groups_select]
    else:
        user_group_id = request.POST.get('user_group_id')
        asset_group_id_list = request.POST.getlist('asset_groups_select')
        perm_group_update(user_group_id, asset_group_id_list)

        return HttpResponseRedirect('/jperm/perm_list/')
    return render_to_response('jperm/perm_edit.html', locals(), context_instance=RequestContext(request))


@require_admin
def perm_edit_adm(request):
    if request.method == 'GET':
        header_title, path1, path2 = u'编辑授权', u'授权管理', u'授权编辑'
        user_group_id = request.GET.get('id', '')
        user_group = UserGroup.objects.filter(id=user_group_id)
        user, dept = get_session_user_dept(request)
        if user_group:
            user_group = user_group[0]
            asset_groups_all = dept.bisgroup_set.all()
            asset_groups_select = [perm.asset_group for perm in user_group.perm_set.all()]
            asset_groups = [asset_group for asset_group in asset_groups_all if asset_group not in asset_groups_select]
    else:
        user_group_id = request.POST.get('user_group_id')
        asset_group_id_list = request.POST.getlist('asset_groups_select')
        if not validate(request, user_group=[user_group_id], asset_group=asset_group_id_list):
            return HttpResponseRedirect('/jperm/perm_list/')
        perm_group_update(user_group_id, asset_group_id_list)

        return HttpResponseRedirect('/jperm/perm_list/')
    return render_to_response('jperm/perm_edit.html', locals(), context_instance=RequestContext(request))

@require_admin
def perm_detail(request):
    header_title, path1, path2 = u'编辑授权', u'授权管理', u'授权详情'
    perm_id = request.GET.get('id')
    perm = Perm.objects.filter(id=perm_id)
    if perm:
        perm = perm[0]
        user_groups = perm.user_group.all()
        asset_groups = perm.asset_group.all()

        users_list = []
        assets_list = []

        for user_group in user_groups:
            users_list.extend(user_group.user_set.all())
        for asset_group in asset_groups:
            assets_list.extend(asset_group.asset_set.all())

    return render_to_response('jperm/perm_detail.html', locals(), context_instance=RequestContext(request))


@require_admin
def perm_del(request):
    perm_id = request.GET.get('id')
    perm = Perm.objects.filter(id=perm_id)
    if perm:
        perm = perm[0]
        perm.delete()
    return HttpResponseRedirect('/jperm/perm_list/')


@require_admin
def perm_asset_detail(request):
    header_title, path1, path2 = u'用户授权主机', u'权限管理', u'用户主机详情'
    user_id = request.GET.get('id')
    user = User.objects.filter(id=user_id)
    if user:
        user = user[0]
        assets_list = user_perm_asset_api(user.username)
    return render_to_response('jperm/perm_asset_detail.html', locals(), context_instance=RequestContext(request))


# def sudo_db_add(name, user_runas, user_groups_select, asset_groups_select, cmd_groups_select, comment):
#     user_groups_select_list, asset_groups_select_list, cmd_groups_select_list = \
#         user_asset_cmd_groups_get(user_groups_select, asset_groups_select, cmd_groups_select)
#
#     sudo_perm = SudoPerm(name=name, user_runas=user_runas, comment=comment)
#     sudo_perm.save()
#     sudo_perm.user_group = user_groups_select_list
#     sudo_perm.asset_group = asset_groups_select_list
#     sudo_perm.cmd_group = cmd_groups_select_list


def unicode2str(unicode_list):
    return [str(i) for i in unicode_list]


def sudo_ldap_add(user_group, user_runas, asset_groups_select,
                  cmd_groups_select):

    if not LDAP_ENABLE:
        return True

    assets = []
    cmds = []
    user_runas = user_runas.split(',')
    if len(asset_groups_select) == 1 and asset_groups_select[0].name == 'ALL':
        asset_all = True
    else:
        asset_all = False
        for asset_group in asset_groups_select:
            assets.extend(asset_group.asset_set.all())

    if user_group.name == 'ALL':
        user_all = True
        users = []
    else:
        user_all = False
        users = user_group.user_set.all()

    for cmd_group in cmd_groups_select:
        cmds.extend(cmd_group.cmd.split(','))

    if user_all:
        users_name = ['ALL']
    else:
        users_name = list(set([user.username for user in users]))

    if asset_all:
        assets_ip = ['ALL']
    else:
        assets_ip = list(set([asset.ip for asset in assets]))

    name = 'sudo%s' % user_group.id
    sudo_dn = 'cn=%s,ou=Sudoers,%s' % (name, LDAP_BASE_DN)
    sudo_attr = {'objectClass': ['top', 'sudoRole'],
                 'cn': ['%s' % name],
                 'sudoCommand': unicode2str(cmds),
                 'sudoHost': unicode2str(assets_ip),
                 'sudoOption': ['!authenticate'],
                 'sudoRunAsUser': unicode2str(user_runas),
                 'sudoUser': unicode2str(users_name)}
    print sudo_dn
    ldap_conn.delete(sudo_dn)
    ldap_conn.add(sudo_dn, sudo_attr)


def sudo_update(user_group, user_runas, asset_groups_select, cmd_groups_select, comment):
    asset_groups_select_list, cmd_groups_select_list = \
        asset_cmd_groups_get(asset_groups_select, cmd_groups_select)
    sudo_perm = user_group.sudoperm_set.all()
    if sudo_perm:
        sudo_perm.update(user_runas=user_runas, comment=comment)
        sudo_perm = sudo_perm[0]
        sudo_perm.asset_group = asset_groups_select_list
        sudo_perm.cmd_group = cmd_groups_select_list
    else:
        sudo_perm = SudoPerm(user_group=user_group, user_runas=user_runas, comment=comment)
        sudo_perm.save()
        sudo_perm.asset_group = asset_groups_select_list
        sudo_perm.cmd_group = cmd_groups_select_list

    sudo_ldap_add(user_group, user_runas, asset_groups_select_list, cmd_groups_select_list)


# @require_super_user
# def sudo_add(request):
#     header_title, path1, path2 = u'Sudo授权', u'权限管理', u'添加Sudo权限'
#     user_groups = UserGroup.objects.filter(id__gt=2)
#     asset_groups = BisGroup.objects.all()
#     cmd_groups = CmdGroup.objects.all()
#
#     if request.method == 'POST':
#         name = request.POST.get('name')
#         users_runas = request.POST.get('runas', 'root')
#         user_groups_select = request.POST.getlist('user_groups_select')
#         asset_groups_select = request.POST.getlist('asset_groups_select')
#         cmd_groups_select = request.POST.getlist('cmd_groups_select')
#         comment = request.POST.get('comment', '')
#
#         if LDAP_ENABLE:
#             sudo_db_add(name, users_runas, user_groups_select, asset_groups_select, cmd_groups_select, comment)
#             sudo_ldap_add(name, users_runas, user_groups_select, asset_groups_select, cmd_groups_select)
#
#         msg = '添加成功'
#     return render_to_response('jperm/sudo_add.html', locals(), context_instance=RequestContext(request))


# @require_admin
# def sudo_add_adm(request):
#     header_title, path1, path2 = u'Sudo授权', u'权限管理', u'添加Sudo权限'
#     user, dept = get_session_user_dept(request)
#     user_groups = dept.usergroup_set.filter(id__gt=2)
#     asset_groups = dept.bisgroup_set.all()
#     cmd_groups = CmdGroup.objects.all()
#
#     if request.method == 'POST':
#         name = request.POST.get('name')
#         users_runas = request.POST.get('runas', 'root')
#         user_groups_select = request.POST.getlist('user_groups_select')
#         asset_groups_select = request.POST.getlist('asset_groups_select')
#         cmd_groups_select = request.POST.getlist('cmd_groups_select')
#         comment = request.POST.get('comment', '')
#
#         if LDAP_ENABLE:
#             sudo_db_add(name, users_runas, user_groups_select, asset_groups_select, cmd_groups_select, comment)
#             sudo_ldap_add(name, users_runas, user_groups_select, asset_groups_select, cmd_groups_select)
#
#         msg = '添加成功'
#     return render_to_response('jperm/sudo_add.html', locals(), context_instance=RequestContext(request))


@require_super_user
def sudo_list(request):
    header_title, path1, path2 = u'Sudo授权', u'权限管理', u'Sudo权限详情'
    keyword = request.GET.get('search', '')
    contact_list = UserGroup.objects.all().order_by('name')
    if keyword:
        contact_list = contact_list.filter(Q(name__icontains=keyword) | Q(comment__icontains=keyword))

    contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(contact_list, request)
    return render_to_response('jperm/sudo_list.html', locals(), context_instance=RequestContext(request))


@require_admin
def sudo_list_adm(request):
    header_title, path1, path2 = u'Sudo授权', u'权限管理', u'Sudo权限详情'
    keyword = request.GET.get('search', '')
    user, dept = get_session_user_dept(request)
    contact_list = dept.usergroup_set.all().order_by('name')
    if keyword:
        contact_list = contact_list.filter(Q(name__icontains=keyword) | Q(comment__icontains=keyword))

    contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(contact_list, request)
    return render_to_response('jperm/sudo_list.html', locals(), context_instance=RequestContext(request))


@require_super_user
def sudo_edit(request):
    header_title, path1, path2 = u'Sudo授权', u'授权管理', u'Sudo授权'

    if request.method == 'GET':
        user_group_id = request.GET.get('id', '0')
        user_group = UserGroup.objects.filter(id=user_group_id)
        asset_group_all = BisGroup.objects.filter()
        cmd_group_all = CmdGroup.objects.all()
        if user_group:
            user_group = user_group[0]
            sudo_perm = user_group.sudoperm_set.all()
            if sudo_perm:
                sudo_perm = sudo_perm[0]
                asset_group_permed = sudo_perm.asset_group.all()
                cmd_group_permed = sudo_perm.cmd_group.all()
                user_runas = sudo_perm.user_runas
                comment = sudo_perm.comment
            else:
                asset_group_permed = []
                cmd_group_permed = []

            asset_groups = [asset_group for asset_group in asset_group_all if asset_group not in asset_group_permed]
            cmd_groups = [cmd_group for cmd_group in cmd_group_all if cmd_group not in cmd_group_permed]

    else:
        user_group_id = request.POST.get('user_group_id', '')
        users_runas = request.POST.get('runas', 'root')
        asset_groups_select = request.POST.getlist('asset_groups_select')
        cmd_groups_select = request.POST.getlist('cmd_groups_select')
        comment = request.POST.get('comment', '')
        user_group = UserGroup.objects.filter(id=user_group_id)
        if user_group:
            user_group = user_group[0]
            if LDAP_ENABLE:
                sudo_update(user_group, users_runas, asset_groups_select, cmd_groups_select, comment)
                msg = '修改成功'

        return HttpResponseRedirect('/jperm/sudo_list/')

    return render_to_response('jperm/sudo_edit.html', locals(), context_instance=RequestContext(request))


@require_admin
def sudo_edit_adm(request):
    header_title, path1, path2 = u'Sudo授权', u'授权管理', u'Sudo授权'
    user, dept = get_session_user_dept(request)
    if request.method == 'GET':
        user_group_id = request.GET.get('id', '0')
        if not validate(request, user_group=[user_group_id]):
            return render_to_response('/jperm/sudo_list/')
        user_group = UserGroup.objects.filter(id=user_group_id)
        asset_group_all = dept.bisgroup_set.all()
        cmd_group_all = dept.cmdgroup_set.all()
        if user_group:
            user_group = user_group[0]
            sudo_perm = user_group.sudoperm_set.all()
            if sudo_perm:
                sudo_perm = sudo_perm[0]
                asset_group_permed = sudo_perm.asset_group.all()
                cmd_group_permed = sudo_perm.cmd_group.all()
                user_runas = sudo_perm.user_runas
                comment = sudo_perm.comment
            else:
                asset_group_permed = []
                cmd_group_permed = []

            asset_groups = [asset_group for asset_group in asset_group_all if asset_group not in asset_group_permed]
            cmd_groups = [cmd_group for cmd_group in cmd_group_all if cmd_group not in cmd_group_permed]

    else:
        user_group_id = request.POST.get('user_group_id', '')
        users_runas = request.POST.get('runas', 'root')
        asset_groups_select = request.POST.getlist('asset_groups_select')
        cmd_groups_select = request.POST.getlist('cmd_groups_select')
        comment = request.POST.get('comment', '')
        user_group = UserGroup.objects.filter(id=user_group_id)
        if not validate(request, user_group=[user_group_id], asset_group=asset_groups_select):
            return render_to_response('/jperm/sudo_list/')
        if user_group:
            user_group = user_group[0]
            if LDAP_ENABLE:
                sudo_update(user_group, users_runas, asset_groups_select, cmd_groups_select, comment)
                msg = '修改成功'

        return HttpResponseRedirect('/jperm/sudo_list/')
    return render_to_response('jperm/sudo_edit.html', locals(), context_instance=RequestContext(request))


@require_admin
def sudo_refresh(request):
    sudo_perm_all = SudoPerm.objects.all()
    for sudo_perm in sudo_perm_all:
        user_group = sudo_perm.user_group
        user_runas = sudo_perm.user_runas
        asset_groups_select = sudo_perm.asset_group.all()
        cmd_groups_select = sudo_perm.cmd_group.all()
        sudo_ldap_add(user_group, user_runas, asset_groups_select, cmd_groups_select)
    return HttpResponse('ok')

# @require_admin
# def sudo_detail(request):
#     header_title, path1, path2 = u'Sudo授权详情', u'授权管理', u'授权详情'
#     sudo_perm_id = request.GET.get('id')
#     sudo_perm = SudoPerm.objects.filter(id=sudo_perm_id)
#     if sudo_perm:
#         sudo_perm = sudo_perm[0]
#         user_groups = sudo_perm.user_group.all()
#         asset_groups = sudo_perm.asset_group.all()
#         cmd_groups = sudo_perm.cmd_group.all()
#
#         users_list = []
#         assets_list = []
#         cmds_list = []
#
#         for user_group in user_groups:
#             users_list.extend(user_group.user_set.all())
#         for asset_group in asset_groups:
#             assets_list.extend(asset_group.asset_set.all())
#         for cmd_group in cmd_groups:
#             cmds_list.append({cmd_group.name: cmd_group.cmd.split(',')})
#
#         return render_to_response('jperm/sudo_detail.html', locals(), context_instance=RequestContext(request))


# @require_admin
# def sudo_del(request):
#     sudo_perm_id = request.GET.get('id', '0')
#     sudo_perm = SudoPerm.objects.filter(id=int(sudo_perm_id))
#     if sudo_perm:
#         name = sudo_perm[0].name
#         sudo_perm.delete()
#         sudo_dn = 'cn=%s,ou=Sudoers,%s' % (name, LDAP_BASE_DN)
#         ldap_conn.delete(sudo_dn)
#     return HttpResponseRedirect('/jperm/sudo_list/')


@require_super_user
def cmd_add(request):
    header_title, path1, path2 = u'sudo命令添加', u'授权管理', u'命令组添加'
    dept_all = DEPT.objects.all()

    if request.method == 'POST':
        name = request.POST.get('name')
        dept_id = request.POST.get('dept_id')
        cmd = ','.join(request.POST.get('cmd').split())
        comment = request.POST.get('comment')

        dept = DEPT.objects.filter(id=dept_id)
        if dept:
            dept = dept[0]
            CmdGroup.objects.create(name=name, dept=dept, cmd=cmd, comment=comment)
        else:
            error = u"部门不能为空"
        msg = u'命令组添加成功'

        return HttpResponseRedirect('/jperm/cmd_list/')

    return render_to_response('jperm/sudo_cmd_add.html', locals(), context_instance=RequestContext(request))


@require_admin
def cmd_add_adm(request):
    header_title, path1, path2 = u'sudo命令添加', u'授权管理', u'命令组添加'
    user, dept = get_session_user_dept(request)

    if request.method == 'POST':
        name = request.POST.get('name')
        cmd = ','.join(request.POST.get('cmd').split())
        comment = request.POST.get('comment')

        CmdGroup.objects.create(name=name, dept=dept, cmd=cmd, comment=comment)
        msg = u'命令组添加成功'
        return HttpResponseRedirect('/jperm/cmd_list/')

    return render_to_response('jperm/sudo_cmd_add.html', locals(), context_instance=RequestContext(request))


@require_admin
def cmd_edit(request):
    header_title, path1, path2 = u'sudo命令修改', u'授权管理管理', u'命令组修改'

    cmd_group_id = request.GET.get('id')
    cmd_group = CmdGroup.objects.filter(id=cmd_group_id)

    if cmd_group:
        cmd_group = cmd_group[0]
        cmd_group_id = cmd_group.id
        name = cmd_group.name
        cmd = '\n'.join(cmd_group.cmd.split(','))
        comment = cmd_group.comment

    if request.method == 'POST':
        cmd_group_id = request.POST.get('cmd_group_id')
        name = request.POST.get('name')
        cmd = ','.join(request.POST.get('cmd').split())
        comment = request.POST.get('comment')

        cmd_group = CmdGroup.objects.filter(id=cmd_group_id)
        if cmd_group:
            cmd_group.update(name=name, cmd=cmd, comment=comment)
            return HttpResponseRedirect('/jperm/cmd_list/')
    return render_to_response('jperm/sudo_cmd_add.html', locals(), context_instance=RequestContext(request))


@require_admin
def cmd_list(request):
    header_title, path1, path2 = u'sudo命令查看', u'权限管理', u'Sudo命令添加'

    if request.session.get('role_id', '0') == '2':
        cmd_groups = contact_list = CmdGroup.objects.all()
    else:
        user, dept = get_session_user_dept(request)
        cmd_groups = contact_list = dept.cmdgroup_set.all()
    p = paginator = Paginator(contact_list, 10)

    try:
        page = int(request.GET.get('page', '1'))
    except ValueError:
        page = 1

    try:
        contacts = paginator.page(page)
    except (EmptyPage, InvalidPage):
        contacts = paginator.page(paginator.num_pages)
    return render_to_response('jperm/sudo_cmd_list.html', locals(), context_instance=RequestContext(request))


@require_admin
def cmd_del(request):
    cmd_group_id = request.GET.get('id')
    cmd_group = CmdGroup.objects.filter(id=cmd_group_id)

    if cmd_group:
        cmd_group[0].delete()
    return HttpResponseRedirect('/jperm/cmd_list/')


@require_login
def perm_apply(request):
    header_title, path1, path2 = u'主机权限申请', u'权限管理', u'申请主机'
    user_id = request.session.get('user_id')
    username = User.objects.get(id=user_id).username
    dept_id = get_user_dept(request)
    deptname = DEPT.objects.get(id=dept_id).name
    dept = DEPT.objects.get(id=dept_id)
    posts = Asset.objects.filter(dept=dept)
    egroup = dept.bisgroup_set.all()
    dept_da = User.objects.filter(dept_id=dept_id, role='DA')

    if request.method == 'POST':
        applyer = request.POST.get('applyer')
        dept = request.POST.get('dept')
        da = request.POST.get('da')
        group = request.POST.getlist('group')
        hosts = request.POST.getlist('hosts')
        comment = request.POST.get('comment')
        da = User.objects.get(id=da)
        mail_address = da.email
        mail_title = '%s - 权限申请' % username
        group_lis = ', '.join(group)
        hosts_lis = ', '.join(hosts)
        time_now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
        Apply.objects.create(applyer=applyer, dept=dept, bisgroup=group, asset=hosts, status=0, comment=comment)
        uuid = Apply.objects.get(applyer=applyer, asset=hosts, comment=comment).uuid
        url = "http://127.0.0.1:8000/jperm/apply_exec/?uuid=%s" % uuid
        mail_msg = """
        Hi,%s:
            有新的权限申请, 详情如下:
                申请人: %s
                申请主机组: %s
                申请的主机: %s
                申请时间: %s
                申请说明: %s
            请及时审批, 审批完成后点击以下链接,告知申请人。

            %s
        """ % (da.username, applyer, group_lis, hosts_lis, time_now, comment, url)

        send_mail(mail_title, mail_msg, 'jumpserver@163.com', [mail_address], fail_silently=False)
        smg = "提交成功,已发邮件通知部门管理员。"
        return render_to_response('jperm/perm_apply.html', locals(), context_instance=RequestContext(request))
    return render_to_response('jperm/perm_apply.html', locals(), context_instance=RequestContext(request))


@require_admin
def perm_apply_exec(request):
    header_title, path1, path2 = u'主机权限申请', u'权限管理', u'审批完成'
    uuid = request.GET.get('uuid')
    if uuid:
        p_apply = Apply.objects.filter(uuid=str(uuid))
        q_apply = Apply.objects.get(uuid=str(uuid))
        if q_apply.status == 1:
            smg = '此权限已经审批完成, 请勿重复审批, 十秒钟后返回首页'
            return render_to_response('jperm/perm_apply_exec.html', locals(), context_instance=RequestContext(request))
        else:
            user = User.objects.get(username=q_apply.applyer)
            mail_address = user.email
            time_now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
            p_apply.update(status=1, date_end=time_now)
            mail_title = '%s - 权限审批完成' % q_apply.applyer
            mail_msg = """
            Hi,%s:
                您所申请的权限已由 %s 在 %s 审批完成, 请登录验证。
            """ % (q_apply.applyer, q_apply.approver, time_now)
            send_mail(mail_title, mail_msg, 'jkfunshion@fun.tv', [mail_address], fail_silently=False)
            smg = '授权完成, 已邮件通知申请人, 十秒钟后返回首页'
            return render_to_response('jperm/perm_apply_exec.html', locals(), context_instance=RequestContext(request))
    else:
        smg = '没有此授权, 十秒钟后返回首页'
        return render_to_response('jperm/perm_apply_exec.html', locals(), context_instance=RequestContext(request))


def get_apply_posts(request, status, username, dept_name, keyword=None):
    if is_super_user(request):
        if keyword:
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=status).order_by('-date_add')
        else:
            posts = Apply.objects.filter(status=status).order_by('-date_add')

    elif is_group_admin(request):
        if keyword:
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=status).filter(dept=dept_name).order_by('-date_add')
        else:
            posts = Log.objects.filter(status=status).filter(dept=dept_name).order_by('-date_add')

    elif is_common_user(request):
        if keyword:
            posts = Apply.objects.filter(applyer=username).filter(status=status).filter(Q(applyer__contains=keyword) |
                        Q(asset__contains=keyword)).order_by('-date_add')
        else:
            posts = Apply.objects.filter(applyer=username).filter(status=status).order_by('-date_add')
    return posts


@require_login
def perm_apply_log(request, offset):
    header_title, path1, path2 = u'权限申请记录', u'权限管理', u'申请记录'
    keyword = request.GET.get('keyword')
    dept_id = get_user_dept(request)
    dept_name = DEPT.objects.get(id=dept_id).name
    user_id = request.session.get('user_id')
    username = User.objects.get(id=user_id).username
    if offset == 'online':
        posts = get_apply_posts(request, 0, username, dept_name, keyword)
        contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(posts, request)
        return render_to_response('jperm/perm_log_online.html', locals(), context_instance=RequestContext(request))

    elif offset == 'offline':
        posts = get_apply_posts(request, 1, username, dept_name, keyword)
        contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(posts, request)
        return render_to_response('jperm/perm_log_offline.html', locals(), context_instance=RequestContext(request))


def perm_apply_info(request):
    uuid = request.GET.get('uuid')
    post = Apply.objects.get(uuid=uuid)
    return render_to_response('jperm/perm_apply_info.html', locals(), context_instance=RequestContext(request))


def perm_apply_search(request):
    keyword = request.GET.get('keyword')
    env = request.GET.get('env')
    dept_id = get_user_dept(request)
    dept_name = DEPT.objects.get(id=dept_id).name
    user_id = request.session.get('user_id')
    username = User.objects.get(id=user_id).username
    if is_super_user(request):
        if env == 'online':
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=0).order_by('-date_add')
        elif env == 'offline':
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=1).order_by('-date_add')
        contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(posts, request)

    elif is_group_admin(request):
        if env == 'online':
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=0).filter(dept_name=dept_name).order_by('-date_add')
        elif env == 'offline':
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=1).filter(dept_name=dept_name).order_by('-date_add')
        contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(posts, request)

    elif is_common_user(request):
        if env == 'online':
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=0).filter(user=username).order_by('-date_add')
        elif env == 'offline':
            posts = Apply.objects.filter(Q(applyer__contains=keyword) | Q(approver__contains=keyword)) \
                .filter(status=1).filter(applyer=username).order_by('-date_add')
        contact_list, p, contacts, page_range, current_page, show_first, show_end = pages(posts, request)
    return render_to_response('jperm/perm_apply_search.html', locals(), context_instance=RequestContext(request))